CompTIA CySA+ (CS0-002) Cert Prep: 6 Incident Response

Course details

Review essential incident response concepts and best practices as you study for the CompTIA Cybersecurity Analyst (CySA+) (CS0-002) exam. In this installment of the CySA+ (CS0-002) Cert Prep series, instructor Mike Chapple discusses how to classify threats and assess the impact of cybersecurity incidents as he prepares you for the exam. Mike covers the importance of communication during a cybersecurity incident response effort, the symptoms of an incident in progress, the use of forensic tools, and the incident recovery process. After completing this course, you'll be prepared to tackle the Incident Response domain of the CySA+ (CS0-002) exam.

Concepts

Introduction

Incident response
What you need to know
Study resources

Assessing Incidents

Identifying and classifying security incidents
Threat classification
Zero days and the advanced persistent threat
Determining incident severity

Incident Response Process

Build an incident response program
Creating an incident response team
Incident communications plan
Incident identification
Escalation and notification
Mitigation
Containment techniques
Incident eradication and recovery
Validation
Post-incident activities

Indicators of Compromise

Network symptoms
Rogue access points and evil twins
Endpoint symptoms
Application symptoms

Forensic Investigations

Conducting investigations
Evidence types
Introduction to forensics
System and file forensics
File carving
Creating forensic images
Digital forensics toolkit
Operating system analysis
Password forensics
Network forensics
Software forensics
Mobile device forensics
Embedded device forensics
Chain of custody
Ediscovery and evidence production

Conclusion

Next steps